Re: UDP port 80 DDoS attack

2012-02-09 Thread Keegan Holley
2012/2/8 Steve Bertrand > On 2012.02.08 14:23, Drew Weaver wrote: > >> Stop paying transit providers for delivering spoofed packets to the edge >> of your network and they will very quickly develop methods of proving that >> the traffic isn't spoofed, or block it altogether. =) >> > > I firmly be

Re: Middlebox Report and Thank You!

2012-02-09 Thread chris
Look how much time people waste with those all in one devices :) As soon as I get the feeling something is very appliancey I run the other direction On Thu, Feb 9, 2012 at 8:20 PM, Christian Esteve wrote: > Thank you Justine! > > your research recalled me to a recent middlebox-related publicatio

Re: Middlebox Report and Thank You!

2012-02-09 Thread Christian Esteve
Thank you Justine! your research recalled me to a recent middlebox-related publication: "An Untold Story of Middleboxes in Cellular Networks" by Zhaoguang Wang, Zhiyun Qian, Qiang Xu, Zhuoqing Morley Mao, and Ming Zhang, Proceedings of SIGCOMM 2011. (http://conferences.sigcomm.org/sigcomm/2011/pa

Middlebox Report and Thank You!

2012-02-09 Thread Justine Sherry
Hello NANOG! I emailed you a few months ago asking for help understanding typical middlebox deployments in enterprise networks. 57 of you responded - thank you so much! Several of you asked if I'd share the data post-study; I've put together a brief report on our findings here: http://www.eecs.be

Re: UDP port 80 DDoS attack

2012-02-09 Thread Steve Bertrand
On 2012.02.08 14:23, Drew Weaver wrote: Stop paying transit providers for delivering spoofed packets to the edge of your network and they will very quickly develop methods of proving that the traffic isn't spoofed, or block it altogether. =) I firmly believe in this recourse, amongst others..

Re: Firewalls in service provider environments

2012-02-09 Thread David Walker
I'm an end user but I refer to these from time to time: http://www.ietf.org/rfc/rfc3013.txt http://www.ietf.org/rfc/rfc3871.txt I suppose the salient question is what kind of customers are we talking about. Best wishes.

RE: 10G switchrecommendaton

2012-02-09 Thread George Bonser
Hi, Lincoln, *sigh* Ok, I see what happened. We just went through a software upgrade cycle on that unit and it got upgraded to the end of 4.6 instead of being upgraded to the latest release version of EOS. Looks like another upgrade needs to be done, probably to 4.8.3 Thanks. George From:

Re: 10G switchrecommendaton

2012-02-09 Thread lincoln dale
hi George, IGMPv3 snooping has been supported since EOS 4.7. Its enabled by default in EOS 4.8.x. In terms of specifics, there is support for both IGMPv3 snooping & IGMPv3 querier. There isn't currently support for IGMPv3 snooping querier. cheers, lincoln. On Fri, Feb 10, 2012 at 8:17 AM, Ge

RE: 10G switchrecommendaton

2012-02-09 Thread George Bonser
Feb 9 07:42:21 SJC-AGS-01 IgmpSnooping: %IGMPSNOOPING-4-IGMPV3_UNSUPPORTED: IGMPv3 querier detected on interface Port-Channel1 (message repeated 34 times in 625.028 secs) SJC-AGS-01#sho ver Arista DCS-7124S-F Hardware version:06.02 Serial number: JSH10130054 System MAC address: 001c.

Re: 10G switchrecommendaton

2012-02-09 Thread lincoln dale
On Fri, Feb 10, 2012 at 7:24 AM, George Bonser wrote: > It's pretty good gear. The only problem I've had with it is the > limitation of IGMP not working on mLAG VLANs. > IGMP should work just fine with MLAG. IGMP state is sync'd between the MLAG pair. Happy to talk about this more off-list if

Re: 10G switchrecommendaton

2012-02-09 Thread Elliot Finley
On Thu, Feb 9, 2012 at 10:31 AM, Leigh Porter wrote: > Based on this thread I has Arista in today for a show'n'tell and it is pretty > impressive both in terms of features (features that you actually use) and > pricing. > > So a couple of evals on the way... Let us know how the eval goes if you

Re: Slow IN-ADDR.ARPA responses

2012-02-09 Thread John Levine
>We operate B.* and we don't see anything unusual in our locations. Seems to have been routing problems with C. The B server looks fine from here, too. Thanks, all. R's, John

RE: 10G switchrecommendaton

2012-02-09 Thread George Bonser
> > Based on this thread I has Arista in today for a show'n'tell and it is > pretty impressive both in terms of features (features that you actually > use) and pricing. > > So a couple of evals on the way... > > -- > Leigh It's pretty good gear. The only problem I've had with it is the limitat

Re: Slow IN-ADDR.ARPA responses

2012-02-09 Thread Mehmet Akcin
On Feb 8, 2012, at 6:03 PM, John Levine wrote: > I'm seeing surprisingly slow responses from some of the IN-ADDR > servers, like 300ms or more. Are they being attacked by script > kiddies of something? > > R's, > John > > We operate B.* and we don't see anything unusual in our locations. t

Re: 10G switchrecommendaton

2012-02-09 Thread Adrian Minta
Cisco has finally release a new 10G switch, Catalyst 4500-X: http://www.cisco.com/en/US/products/ps12332/index.html Does anyone know the price range, or the FCS date for this ?

RE: 10G switchrecommendaton

2012-02-09 Thread Leigh Porter
> -Original Message- > From: Brent Jones [mailto:br...@brentrjones.com] > Sent: 27 January 2012 06:33 > To: Rodrick Brown > Cc: nanog list > Subject: Re: 10G switchrecommendaton > > On Thu, Jan 26, 2012 at 8:40 PM, Rodrick Brown > wrote: > > > Not to mention Arista's cli runs a busybox

Re: BGP history in enterprise?

2012-02-09 Thread Justin M. Streiner
On Wed, 8 Feb 2012, Andrey Khomyakov wrote: Looking for something to keep track of BGP route changes in a large enterprise. Found http://www.ibgplay.org/, but I can't seem to get in touch with them to obtain that free license needed to start the service. Does anyone know of something that would

RE: UDP port 80 DDoS attack

2012-02-09 Thread Sven Olaf Kamphuis
Stop paying transit providers for delivering spoofed packets to the edge of your network and they will very quickly develop methods of proving that the traffic isn't spoofed, or block it altogether. =) -Drew yes, very smart idea... which makes it completely impossible to have multihomed ne

Re: Slow IN-ADDR.ARPA responses

2012-02-09 Thread Anurag Bhatia
Hi John I have seen similar cases in past with root servers itself. Usually problems are that local anycasted node here goes down and thus traffic is redirected to other nearest server in Europe causing high latency. Can you share traceroute result of a good Vs bad node say A Vs C. Can you see bo